CVE-2026-13611: KiviCare WordPress Information Disclosure

CVE-2026-13611 Overview

CVE-2026-13611 affects the KiviCare WordPress plugin in versions prior to 4.5.5. The plugin fails to enforce authorization checks on several of its REST API endpoints. Unauthenticated attackers can query these endpoints to disclose the patient roster maintained by the plugin. When a payment gateway is configured in the affected instance, the same weakness exposes the payment gateway secret key. The issue is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated remote attackers can retrieve patient records and, when applicable, the payment gateway secret key from vulnerable KiviCare installations.

Affected Products

KiviCare WordPress plugin versions before 4.5.5
WordPress sites operating KiviCare with a configured payment gateway
Clinic and healthcare portals relying on KiviCare REST endpoints

Discovery Timeline

2026-09-01 - CVE-2026-13611 published to the National Vulnerability Database
2026-09-01 - Last updated in the NVD database

Technical Details for CVE-2026-13611

Vulnerability Analysis

KiviCare exposes multiple REST API endpoints used by the plugin's clinic management, appointment, and billing features. The vulnerable versions register these endpoints without a permission_callback that validates the caller's identity or capability. As a result, requests arriving without authentication tokens still reach the handler logic and receive full JSON responses.

One class of affected endpoints returns lists of patients registered in the clinic, including personally identifiable information stored by the plugin. A second class returns configuration state associated with payment integrations. When a merchant secret key is stored in that configuration, it is included in the response body.

Root Cause

The root cause is a missing authorization check on REST route registration, classified as [CWE-200]. WordPress requires plugin authors to supply a permission_callback when calling register_rest_route; when this callback is omitted or set to always return true, any client can invoke the endpoint. KiviCare versions before 4.5.5 rely on implicit access control that the REST layer does not enforce.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker enumerates the WordPress REST namespace to identify KiviCare routes, then issues HTTP GET requests to the vulnerable endpoints. Automated scanners can harvest patient data at scale. Where a payment gateway is enabled, the same request pattern returns the gateway secret key, enabling downstream fraud against the merchant account. Technical details are documented in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-13611

Indicators of Compromise

Unauthenticated HTTP GET requests to /wp-json/ routes registered by the KiviCare plugin, particularly those returning patient or payment configuration data.
Anomalous outbound responses with large JSON payloads containing patient identifiers or gateway configuration fields.
Requests originating from a single IP that iterate across multiple KiviCare REST paths within a short window.

Detection Strategies

Inspect WordPress access logs for /wp-json/kivicare/ requests without a valid X-WP-Nonce header or authenticated session cookie.
Deploy web application firewall rules that flag unauthenticated JSON responses containing fields such as patient email, phone, or secret_key.
Use file integrity monitoring to confirm the installed plugin version matches 4.5.5 or later.

Monitoring Recommendations

Alert on payment gateway API activity that does not correlate with legitimate transactions, indicating possible secret key abuse.
Track the volume of REST responses served by the plugin and baseline normal traffic to spot enumeration bursts.
Correlate WordPress logs with edge proxy telemetry to identify scanners probing KiviCare endpoints across multiple sites.

How to Mitigate CVE-2026-13611

Immediate Actions Required

Upgrade the KiviCare plugin to version 4.5.5 or later on every affected WordPress site.
Rotate any payment gateway secret keys that were configured while a vulnerable version was installed.
Audit patient data access logs and notify affected individuals if unauthorized disclosure is confirmed.

Patch Information

The vendor addressed CVE-2026-13611 in KiviCare 4.5.5 by adding authorization checks to the affected REST endpoints. Site administrators should apply the update through the WordPress plugin manager or by deploying the patched release from the vendor. Refer to the WPScan Vulnerability Report for the specific affected route list.

Workarounds

Restrict access to /wp-json/kivicare/ at the reverse proxy or WAF layer until the plugin can be updated.
Temporarily disable the KiviCare plugin on internet-exposed sites that cannot be patched immediately.
Remove stored payment gateway credentials from the plugin configuration until the update is applied and keys are rotated.

bash

# Block unauthenticated access to KiviCare REST routes at the Nginx layer
location ~ ^/wp-json/kivicare/ {
    if ($http_x_wp_nonce = "") {
        return 403;
    }
}